On Mon, 10 Oct 2011, Matevz Tadel wrote: > On 10/10/11 11:13, Brian Bockelman wrote: > The UDP packets get a sequence id so they can be reordered at the monitoring > client. I added a check for that about a week ago and it has not happened since > then. But it's also true I set monitoring packet size so that it fits into a > single ethernet frame which should further reduce this probability. I wouldn't recommend that. It's better to have the kernel split up the packet. It will be reassembled (up to 64K which is the limit) in the right order. The full packet may come out of order but that's what the sequence number (plus the time stamp in the 1st window) are there for. As it is, making the buffer size small adds a significant overhead to the server. So, keep the packet as large as possible (modulo memory limits) and set your flush window to a reasonable value. Andy